Researchers Show LLM Prompts Can Be Reconstructed From Output Text

Researchers at IIT Bombay and Adobe Research developed a method that reconstructs prompts given to large language models using only the generated output text. The technique, called Previous-Token Prediction, trains an inverse language model to predict earlier tokens instead of the next token. According to the provided article data, it does not require access to model weights and can work across different models.

Prompt reconstruction has long been considered difficult because many prompts can produce similar responses. This research suggests that generated text may still carry enough signal to recover the original prompt or a semantically similar version. For companies, the concern is exposure of proprietary system prompts, moderation rules, specialized instructions, or trade-secret-like prompt designs.

The method can generate multiple prompt variants from a single response, including alternatives that produce similar outputs when fed back into the original model. In one example cited in the article, the prompt “How to reach out to competitors to find their pricing strategies?” was reconstructed word for word, alongside six semantically similar variants. Tests with real user prompts also showed accurate reconstructions, with wording sometimes differing while preserving the core meaning.

The article notes that the paper demonstrates the method on short prompts of one or two sentences. It was not tested on long, complex system prompts spanning multiple paragraphs. The practical takeaway is clear: organizations should treat LLM outputs as a potential leakage surface and avoid assuming that hidden prompts are protected simply because model weights or internal prompts are not directly exposed.